Accessing Managed Identity in Docker Compose App Service

Question

Accessing Managed Identity in Docker Compose App Service

Umer Rashid 110

I am running Docker Compose in an Azure App Service that has system-assigned managed identity enabled. I deployed this docker compose on Azure Container Registry that also had system-assigned managed identity enabled. I also granted this App Service's managed identity the access to a key vault and assigned it the role of 'Key Vault Administrator'. When I run this app, I get this error: "const err = new AggregateAuthenticationError(errors, "ChainedTokenCredential authentication failed."); AggregateAuthenticationError: ChainedTokenCredential authentication failed. CredentialUnavailableError: EnvironmentCredential is unavailable. No underlying credential could be used. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot. CredentialUnavailableError: WorkloadIdentityCredential: is unavailable. tenantId, clientId, and federatedTokenFilePath are required parameters." Can anyone please tell me if I have to make some other configurations to make this work? Regards, Umar

Accepted answer

1 additional answer

Your answer

Answer 1

@Umer Rashid It seems like you are trying to access a key vault from your Docker Compose app running in an Azure App Service with system-assigned managed identity enabled. The error message you are seeing indicates that the app is unable to authenticate using the available credentials. To troubleshoot this issue, you can try the following steps:

Make sure that the managed identity of your App Service has been granted access to the key vault and has the appropriate permissions. You can check this by going to the Access policies tab in the Azure portal and verifying that the managed identity is listed with the correct role.
Make sure that your Docker Compose app is running with the correct environment variables. You can set the environment variables for your app in the Docker Compose file or in the Azure portal. The environment variables should include the following:
- AZURE_CLIENT_ID: The client ID of the managed identity.
- AZURE_CLIENT_SECRET: The client secret of the managed identity. This is not required for system-assigned managed identities.
- AZURE_TENANT_ID: The tenant ID of the Azure AD directory that the managed identity belongs to.
- AZURE_MANAGED_IDENTITY_ENDPOINT: The endpoint for the managed identity service. This is not required for system-assigned managed identities.
Make sure that your Docker Compose app is using the correct Azure SDK version and that the SDK is configured to use the managed identity. You can use the DefaultAzureCredential class from the Azure SDK to authenticate with the managed identity. Here's an example of how you can use the DefaultAzureCredential class to authenticate with the managed identity:

const { DefaultAzureCredential } = require("@azure/identity");
const { SecretClient } = require("@azure/keyvault-secrets");

const credential = new DefaultAzureCredential();
const vaultName = "&lt;your-key-vault-name&gt;";
const url = `https://${vaultName}.vault.azure.net`;

const client = new SecretClient(url, credential);

const secretName = "&lt;your-secret-name&gt;";
const secret = await client.getSecret(secretName);

console.log(`The value of ${secretName} is ${secret.value}.`);

You are correct that system-assigned managed identities are not supported with multi-container web apps in Azure App Service. In this case, using a service principal is a recommended approach to access Key Vault from a Docker Compose web app. To use a service principal to access Key Vault from a Docker Compose web app, you can follow the steps outlined in the article you mentioned. Here's a summary of the steps: Create a service principal in Azure AD and grant it access to the Key Vault. Store the service principal's credentials in the environment file of your Docker Compose app. Use the Azure SDK to authenticate with the service principal and access the Key Vault secrets.

Here's an example of how you can use the Azure SDK to authenticate with the service principal and access the Key Vault secrets:

const { ClientSecretCredential } = require("@azure/identity");
const { SecretClient } = require("@azure/keyvault-secrets");

const clientId = "<your-service-principal-client-id>";
const clientSecret = "<your-service-principal-client-secret>";
const tenantId = "<your-tenant-id>";
const vaultName = "<your-key-vault-name>";
const url = `https://${vaultName}.vault.azure.net`;

const credential = new ClientSecretCredential(tenantId, clientId, clientSecret);
const client = new SecretClient(url, credential);

const secretName = "<your-secret-name>";
const secret = await client.getSecret(secretName);

console.log(`The value of ${secretName} is ${secret.value}.`);

Answer 2

Deepanshu katara 14,810 MVP

Hi Umer, As of now managed identities is not supported with Multi-container webapps . Web App for Multi Containers is still in preview. You can keep up to date by checking this documentation or on the App Service Team blog site. Please let us know if you have further questions. Thanks Deepanshu

Umer Rashid 110 Reputation points

2024-01-30T12:19:16.5566667+00:00

Hi Deepanshu Thanks for the prompt response. Can you please let me know what are the recommended practices for securely accessing keyvault from within a docker compose deployed in an Azure App? I am using system-assigned managed identity to access keyvault in a Nodejs-based Azure app but it seems I need a different approach in docker compose.
Deepanshu katara 14,810 Reputation points MVP

2024-01-30T12:30:44.5466667+00:00
For your Web App to safely use secret from the key vault, you will need to use a managed identity. After enabling the managed identity, you'll need to give this identity the necessary permissions on the key vault to get the secrets . Instead of pulling them from environment variables as is standard in many Docker setups, you should modify your application code to fetch these credentials directly from the Key Vault at runtime using Azure's SDKs, which provide methods to interact with the Key Vault and To modify your application code to fetch credentials directly from Azure Key Vault at runtime using Azure's SDKs, you'll want to integrate the Azure Key Vault SDK for Node.js into your Node.js application. Here's a step-by-step guide: Step 1: Install the Azure Key Vault SDK for Node.js Ensure that you have the @azure/keyvault-secrets package installed. You can install it using npm: npm install @azure/keyvault-secrets Step 2: Update Application Code Modify your Node.js application code to use the Azure Key Vault SDK to fetch secrets from Azure Key Vault at runtime

const { SecretClient } = require("@azure/keyvault-secrets"); const { DefaultAzureCredential } = require("@azure/identity"); // Set your Key Vault URL const keyVaultUrl = "https://your-key-vault-name.vault.azure.net/"; // Create a SecretClient using the DefaultAzureCredential const credential = new DefaultAzureCredential(); const secretClient = new SecretClient(keyVaultUrl, credential); // Function to fetch a secret from Key Vault async function getSecret(secretName) { const secret = await secretClient.getSecret(secretName); return secret.value; } // Example usage (async () => { try { const mySecret = await getSecret("my-secret"); console.log("Fetched secret:", mySecret); // Use the secret in your application logic // ... } catch (error) { console.error("Error fetching secret:", error.message); } })();

Since your application now gets these values from the Key Vault, there's no need to mention them in the Docker Compose file, enhancing your app's security. Hope this helps If you found this answer helpful, please consider marking it as accepted so that other users can easily find this topic.
Umer Rashid 110 Reputation points

2024-01-30T12:39:54.5233333+00:00

I can access keyvault from system-assigned managed identity within Nodejs-based App Service, but I can't access keyvault from system-assigned managed identity within Docker Compose.
Umer Rashid 110 Reputation points

2024-01-30T12:47:26.77+00:00

I can access keyvault from system-assigned managed identity within Nodejs-based App Service, but I can't access keyvault from system-assigned managed identity within Docker Compose. What I understand from your answer is that managed identities are not supported with Multi-container webapps. So I want to know how can I securely access keyvault from an App Service using a Docker Compose?
Deepanshu katara 14,810 Reputation points MVP

2024-01-30T12:59:35.94+00:00

Hi Yes, please find this https://kevinle.medium.com/securely-store-and-access-secrets-in-azure-keyvault-from-docker-based-app-service-babe463fe57b, it has the complete steps Securely store and access secrets in Azure KeyVault from Docker-compse based App Service
Deepanshu katara 14,810 Reputation points MVP

2024-01-30T13:00:28.74+00:00

Please let me know if anything else needed but in that doc everything is given just follow please
Deepanshu katara 14,810 Reputation points MVP

2024-01-31T04:51:37.7466667+00:00

Hi Umer , Following up to see if the provided answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Umer Rashid 110 Reputation points

2024-01-31T12:17:32.7566667+00:00

Hi Deepanshu I am not clear about some points in this article: [ https://kevinle.medium.com/securely-store-and-access-secrets-in-azure-keyvault-from-docker-based-app-service-babe463fe57b] The article suggest using system-assigned managed identity with docker compose, but as you explained earlier, managed identities are not supported with muti-container web apps. In that case, the option is to create a service principal, grant it access to the keyvault and store the service principal's credentials in the environment file. Is that the recommended approach to access keyvault from docker compose webapp? Please let me know if my understanding is correct.
Deepanshu katara 14,810 Reputation points MVP

2024-01-31T13:03:20.53+00:00

Ok then can you please tell exact issue and what you are expecting as I already mentioned in my previous comments ?
Umer Rashid 110 Reputation points

2024-01-31T14:36:31.1833333+00:00

Please see the question above. I don't know why it got truncated.

Share via

Accessing Managed Identity in Docker Compose App Service

1 additional answer

Your answer